Privacy Policy for Gathrly

Last Updated: 6/24/26

Welcome to Gathrly ("we," "our," or "us"). We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and related services (collectively, the "Services"). Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the application.

1. Information We Collect

We may collect information about you in a variety of ways. The information we may collect via the Application includes:

a) Personal Data: Personally identifiable information, such as your name, email address, and telephone number, and demographic information, such as your age, gender, hometown, and interests, that you voluntarily give to us when you register with the Application.

b) User-Generated Content: Information that you provide when you create events, send messages, participate in polls, or otherwise use the interactive features of our Services. This includes event details (title, location, time), messages in event chats, and poll responses.

c) Calendar Information: With your permission, we connect to your Google Calendar (using Google's calendar.readonly scope) or Apple Calendar to help find times that work for your group. When you connect your calendar:

• We request read-only access. We cannot create, edit, or delete events in your calendar.
• We read only event start and end times from your primary calendar within the date range of a Gathrly event. We do not access event titles, descriptions, attendees, locations, or any other event details.
• We derive busy/free time blocks from your calendar events and store these time ranges in our database to calculate group availability and generate scheduling suggestions. We do not store the underlying calendar event data itself.
• Your calendar connection credentials (OAuth tokens) are encrypted at rest using AES encryption in our database.
• You can disconnect your calendar at any time from Settings, which immediately deletes your stored tokens. You can also revoke access from your Google Account settings at myaccount.google.com/permissions.

d) Contact Information (Find Friends): With your permission, the Application can read email addresses and phone numbers from your device's contact list to help you find friends who are already on Gathrly. When you use this feature:

• We read only email addresses and phone numbers from your contacts. We do not access contact names, photos, addresses, or any other fields.
• This data is sent securely to our servers, where it is cryptographically hashed (HMAC) and compared against hashed identifiers of existing Gathrly users.
• Your raw contact data is never stored on our servers. It is used only for the matching process and discarded immediately after.
• If you grant contacts permission, the Application may periodically re-check your contacts (approximately every 24 hours) to surface new friend suggestions.
• You can disconnect contacts access at any time in Settings. You can also control whether other users can find you by email or phone number through the "Who Can Find Me" toggles in Settings.

e) Device and Usage Information: Information automatically collected about your device and how you use the Application, such as your IP address, browser type, operating system, access times, and the pages you have viewed directly before and after accessing the Application.

f) Diagnostic and Error Reporting Data: When the Application encounters an error or crash, we automatically collect diagnostic information to help us identify and fix problems. This includes:

• Your user account identifier (a random UUID — we do not send your email address, password, or phone number with error reports)
• Your IP address, which is used to derive an approximate geographic location
• Device information (model, operating system version, app version, screen size, locale, timezone)
• A short history of your recent actions in the app (page navigation, button taps, and network requests immediately before the error)
• Technical details about the error (stack trace, error message, response codes from our backend)

We use this information solely to debug and improve the Application. We do not use it for advertising and do not share it with advertisers. Free-text content you have entered (such as event titles, descriptions, locations, and chat messages) is automatically redacted from error reports before transmission and is never sent to our error-reporting provider.

g) Approximate Location for Address Search: When you type into a Location field while creating or editing an event, we use your approximate location to suggest nearby addresses. This location is derived from two sources, in order of preference:

1. Your IP address, processed at the network edge by Cloudflare (see Section 3(b)). We receive only an approximate location — typically the city, region, country, and a coarse latitude/longitude (accurate to roughly 25–50 km). We do not receive your precise GPS coordinates.
2. Your device timezone (e.g., America/Los_Angeles), used as a fallback when the IP-derived location isn't available. This is mapped to the approximate center of the nearest major city.

This approximate location is cached on your device for 24 hours and is not stored on our servers. Each time you type into the Location field, we send the search text and your approximate coordinates to Mapbox (see Section 3(b)) to retrieve address suggestions. We do not request, collect, or store your precise GPS location at any time.

2. How We Use Your Information

Having accurate information about you permits us to provide you with a smooth, efficient, and customized experience. Specifically, we may use information collected about you via the Application to:

• Create and manage your account.
• Facilitate the creation and management of events.
• Communicate with you about your account or events.
• Send you push notifications regarding your events and account.
• Help you find friends who are already using Gathrly by matching contact information as described in Section 1(d).
• Analyze usage and trends to improve our Services.
• Prevent fraudulent transactions, monitor against theft, and protect against criminal activity.
• Request feedback and contact you about your use of the Application.
• Diagnose, troubleshoot, and prevent errors and crashes in the Application.

We do not sell, rent, or trade your personal information to third parties.

2a. Google Calendar Data: Limited Use Disclosure

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we:

• Use Google Calendar data only to provide and improve Gathrly's scheduling features (finding mutual free times for group events).
• Do not use Google Calendar data for advertising, including targeted, personalized, retargeted, or interest-based advertising.
• Do not sell, rent, or transfer Google Calendar data to third parties, data brokers, or information resellers.
• Do not use Google Calendar data to determine creditworthiness or for lending purposes.
• Do not use Google Calendar data to train artificial intelligence or machine learning models.
• Do not allow humans to read your Google Calendar data unless required for security purposes, to comply with applicable law, or with your explicit consent.

2b. Mapbox Geocoding Data Use

Our use of Mapbox's Geocoding API adheres to Mapbox's published Terms of Service. Specifically, with respect to data sent to Mapbox:

• We send only the address text you have typed plus your approximate location (country code, latitude/longitude, and a bounding box) for the purpose of returning relevant address suggestions.
• We do not send your account identifier, email, phone number, contact list, calendar data, friends list, event participants, or any other personal data with Mapbox queries.
• Selected address text is stored in your Gathrly events as freeform user-generated content (see Section 1(b)). Mapbox does not receive your saved events.

3. Disclosure of Your Information

We may share information we have collected about you in certain situations. Your information may be disclosed as follows:

a) By Law or to Protect Rights: If we believe the release of information about you is necessary to respond to legal process, to investigate or remedy potential violations of our policies, or to protect the rights, property, and safety of others, we may share your information as permitted or required by any applicable law, rule, or regulation.

b) Third-Party Service Providers: We may share your information with the following third-party service providers that perform services for us or on our behalf:

• Supabase - Backend database and infrastructure services
• Google and Apple - Authentication and sign-in services
• Firebase Cloud Messaging (FCM) - Push notification delivery
• Cloudflare - Content delivery and security services
• Mapbox - Address geocoding and autocomplete. When you type into a Location field, your search text and approximate coordinates are sent to Mapbox to return matching address suggestions. Mapbox processes this data under their own Privacy Policy and Terms of Service. We do not share your account identifier, email, phone number, or any other personal identifier with Mapbox.
• Calendar Service Providers - Google, Apple, and other calendar APIs for integration services
• Sentry - Crash reporting, error monitoring, and diagnostic data processing. Sentry receives the diagnostic data described in Section 1(f) on our behalf. Sentry is a registered data processor and is contractually obligated to handle this data only for the purpose of helping us debug the Application.

These providers are contractually obligated to protect your information and use it only for the specific services they provide to us.

c) Other Users: Your information, such as your name and profile picture, will be visible to other users you interact with within the app (e.g., guests you invite to an event).

4. Data Retention

Profile Information: We keep your profile information, such as your display name, user name, password and email address for the duration of your account. We cannot provide you with our products and services without retaining this information.

Usage Information: We keep your usage information, such as the content you post, your interactions with other users' content and how you interact with others on the platform for the duration of your account or until such content is removed.

Account Deletion: When you delete your account, we will remove your personal information within 30 days, except where we are required to retain it longer by law. You can request account deletion at any time through the app's Settings or by visiting https://gathrlyapp.com/delete-account.

Calendar Data: We do not store raw calendar event data from third-party services. We derive and store busy/free time blocks (start and end times only) for the duration of your active Gathrly events. When an event is completed, cancelled, or your account is deleted, these time blocks are removed. Calendar OAuth tokens are deleted immediately when you disconnect your calendar.

5. Security of Your Information

We use administrative, technical, and physical security measures to help protect your personal information. While we have taken reasonable steps to secure the personal information you provide to us, please be aware that despite our efforts, no security measures are perfect or impenetrable, and no method of data transmission can be guaranteed against any interception or other type of misuse.

6. Your Rights and Choices

You have certain rights regarding the personal information we hold about you. These may include the right to:

• Access the personal information we hold about you.
• Request that we correct or update any inaccurate personal information.
• Request that we delete your personal information.
• Opt-out of receiving promotional communications from us.

You may review or change the information in your account at any time by logging into your account settings. To delete your account, visit Settings > Safety > Delete Account in the app, or submit a request at https://gathrlyapp.com/delete-account.

7. California Privacy Rights (CCPA)

If you are a California resident, you have specific rights regarding your personal information under the California Consumer Privacy Act (CCPA):

Right to Know: You have the right to request information about the categories and specific pieces of personal information we have collected about you, the categories of sources from which we collect personal information, our business or commercial purpose for collecting personal information, and the categories of third parties with whom we share personal information.

Right to Delete: You have the right to request that we delete personal information we have collected from you, subject to certain exceptions.

Right to Opt-Out: You have the right to opt-out of the sale of your personal information. We do not sell personal information.

Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

Exercising Your Rights: To exercise these rights, please contact us at support@gathrlyapp.com. We will verify your identity before processing your request and respond within 45 days.

8. Children's Privacy

Our Services are not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will delete that information promptly.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. You are advised to review this Privacy Policy periodically for any changes.

10. Contact Us

If you have questions or comments about this Privacy Policy, please contact us at:

Email: support@gathrlyapp.com